T09 · Insecure Skill Coding Practices
Error
- Location
scripts/estimate.sh:17- Finding
Expression and Command Injection Through Unvalidated bc Input
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 ;; esac if [ "$value" -eq 0 ]; then printf 'Error: %s must be greater than zero\n' "$name" >&2 exit 1 fi } require_positive_integer "heartbeat interval" "$HB_INTERVAL" require_positive_integer "tasks per day" "$TASKS_PER_DAY" require_positive_integer "average input tokens" "$AVG_INPUT" require_positive_integer "average output tokens" "$AVG_OUTPUT" ``` 2. Apply explicit upper bounds to prevent overflow and resource-exhaustion input. For example, limit heartbeat values to a reasonable number of seconds, tasks to an operational maximum, and token counts to supported model context limits. 3. Reject whitespace, signs, decimal notation, newlines, statement separators, and calculator-language syntax unless a field explicitly requires decimals. 4. Prefer validated shell integer arithmetic for integer-only operations: ```bash API_CALLS_PER_DAY=$((86400 / HB_INTERVAL)) ``` 5. Where decimal calculations require `bc`, construct a fixed program and substitute only values that have already passed strict validation. Do not pass raw arguments or environment values into calculator source. 6. Add negative tests covering zero, negative values, newlines, very large values, operators, semicolons, parentheses, and implementation-specific `bc` commands. ]]>